Reference

What Each Kind of Leaked Data Enables, and What Actually Revokes It

Changing your password does not touch the session cookie, the connected app, the authenticator seed or the recovery codes that leaked alongside it. Those survive the reset, and most advice stops before it reaches them. This is a lookup: find the item, see what it lets someone do, and see which action actually kills it.

28 items · Revocation behaviour verified 29 July 2026

First, where did it leak from

The source of a leak decides which items you have to write off, so it is worth settling before you read the table.

A service lost a database

Your exposure is bounded by what that one service held, and the notification usually names the fields. Work the rows for those fields, and take the rest as unaffected.

A device or credential vault was compromised

Assume everything the browser and local applications held: saved passwords, session cookies, autofill, authenticator data, SSH keys, VPN configs, wallets and cloud credentials. Nothing tells you which were taken, so the whole set is the working assumption. How stealer logs work.

The four classes

Most guidance sorts leaked data by what it is. Sorting it by what you can do about it is more useful, because that is the part that decides your next action.

Rotatable

Changing the value kills the leaked copy.

Revocable

Someone can invalidate it, but only through a specific action that a password reset does not perform.

Rebindable

You can move to a new value. The old one stays live as a contact, recovery or correlation point.

Immutable

Nothing makes the leaked copy stop being true.

The index

Filter
Jump Rotatable Revocable Rebindable Immutable Myths FAQ
Leaked data types, what people believe fixes each one, and what actually invalidates it
Item What people think fixes it What actually revokes it
PasswordRotatableUntil changedCheckableChanging the password on the breached siteChanging that password everywhere it was reused
Password hashRotatableUntil changedPartly inferableNothing, because the password was hashedChanging the password, which makes the leaked hash worthless
Security-question answersRotatableUntil changedCheckableChanging the account passwordChanging the security answers, where the provider allows it
Device PIN or passcodeRotatableUntil changedAssume compromisedA remote wipe of the deviceChanging the device PIN, and rotating every credential it held
Payment card numberRotatableUntil reissuedCheckableA card reissue from the bankA card reissue, plus cancelling recurring merchant charges
IBAN and direct debit mandateRotatableUntil cancelledCheckableReissuing the payment cardCancelling the direct debit mandate and blocking the creditor
Session cookie or auth tokenRevocableUntil revokedAssume compromisedChanging the account passwordRevoking active sessions (sign out of all devices), then the password
OAuth grant or refresh tokenRevocableUntil revokedCheckableA password change, or signing out everywhereRevoking the app in the connected-apps list
API key or access tokenRevocableUntil revokedCheckableChanging the account passwordDeleting or rotating the API key in the issuing platform
TOTP seed or MFA secretRevocableUntil re-enrolledNo visibilityChanging the account passwordRe-enrolling the authenticator app, which mints a fresh seed
Recovery or backup codesRevocableUntil regeneratedNo visibilityChanging the account passwordRegenerating the backup codes, which invalidates every old one
App-specific passwordRevocableUntil revokedCheckableChanging the main account passwordRevoking that individual app-specific password
SSH private keyRevocableUntil removedPartly inferableA passphrase on the SSH keyRemoving the public key from every host that trusts it
VPN config or WireGuard keyRevocableUntil peer removedPartly inferableChanging the VPN account passwordRemoving the WireGuard peer server-side and reissuing the config
Cloud CLI credentialRevocableUntil revokedCheckableChanging the cloud console passwordRevoking the credential in IAM and rotating the role's keys
Wallet seed phraseRevocablePermanentCheckableChanging the exchange or wallet passwordMoving the funds to a wallet built from a new seed phrase
Phone number, SIM or eSIMRebindableUntil number changesPartly inferableA new SIM card or eSIM profileA new phone number. Re-provisioning a SIM or eSIM keeps the old
Email addressRebindableUntil address changesCheckableChanging the mailbox passwordA new email address, plus repointing every account recovering to it
Username or handleRebindableUntil you moveCheckableDeleting the accountA new username, sharing nothing with the old handle
Home addressRebindableUntil you moveCheckableOpting out of the one people-search site you foundNothing revokes an address. Removal is a repeated opt-out workflow
Device or advertising identifierRebindableDaysNo visibilityResetting the advertising identifierA reset, which holds only until identity graphs re-link it
Date of birthImmutablePermanentNo visibilityNothing, a date of birth is harmless aloneNothing. Reduce where the date of birth can be looked up
National identity numberImmutablePermanentPartly inferablePaying a service to delete it from the dark webNothing. The response is mitigation, never removal
Passport or licence imageImmutablePermanentNo visibilityReissuing the passport or licenceA new document number. The leaked image keeps working
Biometric templateImmutablePermanentNo visibilityNothing, biometrics are safer than passwordsNothing. A face or a voice cannot be reissued
Medical record and insurance numberImmutablePermanentPartly inferableNothing, health data is not exploitableNothing for the record. Some insurers reissue a policy number
Employer, badge number, work historyImmutablePermanentPartly inferableNothing, work details are public anywayNothing. Leaving retires the badge number, not the history
Family and relationship graphImmutablePermanentPartly inferableLocking down social profilesNothing. Relationships are recorded outside your accounts

On can you check: checkable means you can inspect it yourself, in account settings, a token list or a statement. Partly inferable means you can see symptoms rather than the artefact. Assume compromised means there is no direct check, so the source of the leak decides it for you. No visibility means nothing reports it, ever. What monitoring can and cannot see.

Rotatable: changing it kills the leaked copy

The straightforward class. The leaked value stops working the moment you replace it. The catch is that replacing one of these touches nothing in the next section.

A password is the shared secret you type to sign in. A service should never keep the text itself, only a hashed form of it.

What it enables
Direct sign-in anywhere the password was reused, and automated testing of it against hundreds of other services.
People think
Changing it on the site that was breached settles the matter.
Actually revokes it
Changing it everywhere it was reused. Reuse is what turns one breach into several.
Can you check
Yes. Breach-notification services and browser password monitors index credentials that appear in database leaks.
What remains
The reset touches nothing in the revocable class. Open sessions, connected applications and any second factor already copied all stay valid.
Deeper
Which of your data leaked, and what you can change

A password hash is a fixed-length fingerprint of your password, produced by a one-way function so a service can check a login without storing the password. It cannot be reversed, only guessed against repeatedly until a guess matches.

What it enables
Offline cracking at the attacker's own pace. A recovered hash is a password.
People think
Hashed means unreadable, so there is nothing to do.
Actually revokes it
Changing the password. The hash becomes worthless the moment the plaintext behind it changes.
Can you check
Partly. The notification usually names the algorithm, which is the one variable that matters.
What remains
Time, in an amount set by the algorithm. A fast unsalted function such as MD5 or SHA-1 falls quickly. A slow salted one such as bcrypt or argon2 makes recovery expensive, though a weak password still falls.
Deeper
OWASP Password Storage Cheat Sheet

Security questions are a fallback check that verifies you with something you are supposed to know, such as a mother's maiden name or a first school, rather than something you deliberately set.

What it enables
Account recovery in your name at any provider still using knowledge-based verification, which bypasses the password entirely.
People think
Changing the password covers it.
Actually revokes it
Changing the answers, wherever the provider allows it.
Can you check
Yes, in account settings, though most providers will not show you the stored answer.
What remains
A truthful answer was never secret. Mother's maiden name, first school and childhood street sit in public records and people-search profiles. Replace true answers with stored random strings.
Deeper
Why the data you cannot change is the data that verifies you

A device PIN or passcode is the short code that unlocks a phone or laptop. On modern devices it also releases the encryption key protecting everything stored on it.

What it enables
Decryption of a lost or seized device, and usually the credential vault or keychain behind it.
People think
A remote wipe closes it off.
Actually revokes it
Changing the PIN, and rotating everything the device held.
Can you check
No. Treat the source as the answer.
What remains
A wipe only helps if it arrives first. If the device was imaged before it landed, everything stored on it is already out, and this becomes a device compromise rather than a lost phone.
Deeper
What is taken off a compromised device

Card details means the long card number (the PAN) together with the expiry date and CVV, which is enough to charge the card without it being physically present.

What it enables
Card-not-present fraud, and low-value test transactions to confirm the card is live before it is sold on.
People think
A reissue ends the exposure completely.
Actually revokes it
A reissue kills the number. Recurring charges need cancelling separately, at the merchant.
Can you check
Yes, on your statements, and card networks alert on unusual patterns.
What remains
Merchant tokens often survive the reissue. Card-updater services push a new number to merchants who hold a subscription, so anything set up on the stolen card can keep billing on the replacement.
Deeper
Responding by data class

An IBAN identifies your bank account. A direct debit mandate is the standing permission that lets a named company collect from that account, and it is held by your bank rather than by the company.

What it enables
Collections against your account under an existing or fabricated mandate, and credible pretexting because the caller can quote your details.
People think
Reissuing the card also stops the direct debits.
Actually revokes it
Cancelling the mandate at your bank and blocking the creditor. Direct debits run against the account, not the card.
Can you check
Yes. Most banking apps list active mandates and let you block a creditor.
What remains
The account number itself does not change. Within SEPA the refund rights outlast the leak: eight weeks unconditionally for an authorised debit, and thirteen months where no valid mandate existed. Your bank can confirm how this applies to your account.
Deeper
Financial data after a breach

Revocable, but almost nobody revokes them

Each of these can be invalidated. None of them is invalidated by a password reset, and several are not invalidated by signing out either. This is the section that decides whether an attacker keeps access after you think you have closed it, and it is why a device compromise is worse than a database breach. What an infostealer takes off a device is the fullest account of how these are collected in one pass.

An OAuth grant is the permission you give one application to reach your account at another. A refresh token is the long-lived part of that grant, which the application uses to keep renewing its own access without involving you again.

What it enables
Continuing access to your account by a connected application, at whatever scope you granted, independent of your password and your second factor.
People think
Signing out everywhere covers connected apps too.
Actually revokes it
Removing the application from the connected-apps or third-party-access list.
Can you check
Yes. Every major provider lists connected applications, often with a last-used date.
What remains
On several providers a refresh token outlives both a password change and a global sign-out, because revocation is a separate action on a separate screen. The standard defines a revocation endpoint; whether a provider ties it to a password change is that provider's choice.
Deeper
The account takeover kill chain

An API key or personal access token is a long string that authenticates software rather than a person. It carries its own permissions and skips the login screen entirely.

What it enables
Programmatic access at whatever scope the key carries, from anywhere, with no sign-in screen and no second-factor prompt.
People think
Changing the account password disables it.
Actually revokes it
Deleting or rotating the key in the platform that issued it.
Can you check
Yes. Token lists usually show creation and last-used timestamps, which is enough to spot use you did not authorise.
What remains
Keys are long-lived by default, scoped more widely than their owner remembers, and copied into config files, CI variables and shell history. Rotate first, then go looking for the copies.
Deeper
GitHub credential revocation documentation

A TOTP seed, or MFA shared secret, is the random value stored when you scan an authenticator QR code. Your app and the service each derive the six-digit codes from it, so anyone holding the seed generates the same codes you do.

What it enables
Generating valid second-factor codes indefinitely. The attacker's authenticator stays in step with yours.
People think
Changing the password resets the second factor.
Actually revokes it
Removing and re-enrolling the authenticator, which issues a fresh secret and retires the old one.
Can you check
No. Nothing in any account interface reports that a seed has been copied.
What remains
The original QR code or seed string may still sit in a screenshot, a printout, a note, or a synced authenticator backup. Re-enrolment is the only reset, and it has to be repeated per account.
Deeper
Authenticator data in the harvest taxonomy

Recovery codes, also called backup codes, are the list of one-time strings a service issues when you switch on two-factor authentication. Each one substitutes for your second factor once.

What it enables
One single-use bypass of your second factor per code, and then full account control.
People think
Changing the password makes old codes useless.
Actually revokes it
Regenerating the set. On most platforms, issuing a new set invalidates every previous code at once.
Can you check
No. Some platforms show how many codes remain unused, which is a weak signal at best.
What remains
Codes leak because of where they are kept: the downloads folder, a screenshot, an email to yourself. Regenerating helps only if the new set goes somewhere the old one did not.
Deeper
Google backup codes · Microsoft recovery codes

An app-specific password is a separate, per-application password issued for older software that cannot handle a second-factor prompt, which means it bypasses that prompt by design.

What it enables
Mail or calendar access that skips the second factor by design, because it was built for clients that cannot prompt for one.
People think
Changing the main account password revokes them.
Actually revokes it
Revoking that individual app password in the account's app-password list.
Can you check
Yes. The list is visible, and usually shows when each was created.
What remains
These are forgotten because they were created once, years ago, for a mail client nobody uses now. Audit the whole list rather than the one you remember.
Deeper
Where MFA does not apply

An SSH key is a matched pair: a private key you keep and a public key installed on servers. Any server holding the public half accepts the private half as proof of identity, with no password involved.

What it enables
Authenticated access to every host that trusts the matching public key.
People think
A passphrase on the key makes it safe, or changing the account password helps.
Actually revokes it
Removing the public key from every host and platform that trusts it, then issuing a new pair.
Can you check
Partly. Platform key lists and host logs help. Loose entries in files on machines you administer are on you.
What remains
A passphrase buys time rather than safety. The real problem is the set of hosts you have forgotten the key was ever added to, because those keep trusting it.
Deeper
Remote-access credentials in a stealer log

A VPN configuration, such as a WireGuard peer file, holds the key material and server details that let a device join a private network as a trusted member.

What it enables
Network position rather than an account: a route into the private network, arriving as a trusted peer.
People think
Changing the VPN account password closes it.
Actually revokes it
Removing the peer server-side and reissuing the configuration.
Can you check
Partly, through server-side peer lists and connection logs.
What remains
Access of this kind is rarely logged as an intrusion, because it looks like you connecting. Anything reachable only from inside that network should be treated as exposed.
Deeper
VPN configuration harvesting

A cloud CLI credential is the access key stored on a machine so command-line tools can act on a cloud account, usually in a file such as an AWS credentials file or a kubeconfig.

What it enables
Whatever the role permits: data, infrastructure, billing, with no console sign-in and no second-factor prompt.
People think
Changing the console password covers it.
Actually revokes it
Revoking the credential in the identity and access system, and rotating the role's keys.
Can you check
Yes. Last-used data and audit logs are usually detailed enough to scope the exposure.
What remains
These are the highest-value items in a corporate-context stealer log, and they usually sit on a person's laptop rather than a server. The scope is organisational; the device is personal.
Deeper
Cloud credentials in the harvest taxonomy

A seed phrase, or recovery phrase, is the ordered word list from which every private key in a crypto wallet is derived. It is the wallet itself, not a password protecting it.

What it enables
Irreversible transfer of everything the wallet controls, at any point, now or years from now.
People think
Changing the exchange password, or reinstalling the wallet app, resets it.
Actually revokes it
Nothing revokes a seed. Moving the funds to a wallet built from a new seed is the only action that works.
Can you check
Yes, in the sense that the balance is public. That is also how an attacker decides whether to bother.
What remains
The seed stays valid indefinitely, so time is not safety. Every address derived from it stays drainable, including ones you have not used yet.
Deeper
Where crypto exposure actually begins

Rebindable: you can move, and the old value stays live

These look rotatable and are not. You can adopt a new value, but the leaked one keeps working as a contact route, a recovery route, or a key that links your records together.

Your phone number is an identifier held by your carrier, not by the SIM. A SIM card and an eSIM profile are only the credentials that let a particular device claim that number.

What it enables
SMS one-time codes, voice verification and account recovery. The phone unlocks the email, and the email unlocks the rest.
People think
A new SIM card, or re-provisioning an eSIM profile, replaces the exposed value.
Actually revokes it
A new number, plus updating it everywhere it acts as a recovery route. New hardware carries the same number.
Can you check
Partly. Carrier port-out alerts and an unexplained loss of service are the practical signals.
What remains
The old number stays listed at everything you miss, and stays a target for port-out fraud. A carrier port-out PIN and moving second factors off SMS do more here than new hardware.
Deeper
Locking down a leaked phone number

An email address is both a mailbox and, for most services, the account recovery route and the identifier that links your separate accounts to one another.

What it enables
The recovery route for most of your other accounts, and the key that links your records together across unrelated datasets.
People think
Changing the mailbox password is the fix.
Actually revokes it
A new address, and repointing every account that still recovers to the old one.
Can you check
Yes, through breach-notification services and the recovery settings on each account.
What remains
The old address keeps working, keeps being a recovery route wherever you missed it, and stays the join key in every dataset already collected. That last part does not expire.
Deeper
How one email address maps a person

A username or handle is the public name you choose on a service. Reused across platforms, it becomes the thread that ties separate accounts back to one person.

What it enables
Correlation across services, which turns separate accounts into one profile and selects you as a credential-stuffing target.
People think
Deleting the account removes the link.
Actually revokes it
A new handle that shares nothing with the old one.
Can you check
Yes. Searching your own handle shows most of what an analyst would find.
What remains
Archives, caches and screenshots keep the old handle attached to you, and some platforms release a freed handle for someone else to claim.
Deeper
How usernames correlate across platforms

A leaked home address means a residential address published in people-search profiles, public registers and marketing datasets, rather than one you gave a service in confidence.

What it enables
Physical targeting, pretexting that sounds legitimate because the caller knows where you live, and verification answers.
People think
Opting out of the one site where they found it settles it.
Actually revokes it
Nothing revokes an address. Removal is a repeated workflow: opt out at each people-search platform, then re-check, because profiles rebuild.
Can you check
Yes. Searching yourself on the major people-search platforms shows the public position directly.
What remains
Property and electoral registers are generally not removable, and people-search profiles repopulate from them. Reduction is realistic; deletion is not.
Deeper
Removing a home address · EU opt-out list · US opt-out list

A device or advertising identifier is a resettable code that apps read to recognise the same device over time. It is the join key behind most cross-app tracking.

What it enables
Linking your activity across apps and sessions, and re-identifying you after you thought you had reset.
People think
Resetting the advertising identifier starts a clean slate.
Actually revokes it
A reset, which holds only until identity graphs link the new value back to you.
Can you check
No. Re-linking happens on the other side of the transaction.
What remains
Re-linking typically takes days, through signals the device still shares. The reset breaks the chain going forward, and leaves the history already keyed to the old identifier intact.
Deeper
How separate data points combine

Immutable: nothing makes it stop being true

This class cannot be rotated, revoked or rebound. It is also the class that verifies you at banks, registrars and helpdesks, which is what makes it valuable long after the leak. The only available response is to reduce where it can be looked up, and to stop relying on it as proof of identity.

A date of birth is a permanent identifier used to tell apart people with similar names, which is why it appears as a matching field in nearly every records system.

What it enables
Identity verification in your name, security-question answers, and the record matching that links your data across sources.
People think
It is harmless on its own.
Actually revokes it
Nothing. Reduce where it can be looked up, and retire it as a verification answer where a provider offers an alternative.
Can you check
No, beyond seeing where it is published.
What remains
All of it, permanently. It is one of the small number of fields used to match you between otherwise unconnected records, which is what makes aggregation possible.
Deeper
The half you cannot change

A national identity number, such as a Social Security number, BSN or National Insurance number, is a lifelong government identifier that also gets used, unsafely, as a verification secret.

What it enables
Credit applications, tax and benefits fraud, and identity verification in your name.
People think
A service can find it and take it down.
Actually revokes it
Nothing. Nobody can delete a number from circulation, and anyone offering to is selling theatre.
Can you check
Partly, through your credit file and your tax-authority account activity, which show use rather than exposure.
What remains
The number itself, permanently. The realistic response is mitigation: freeze credit where that exists, use an authority-issued verification PIN where one is offered, and watch for accounts opened in your name.
Deeper
The recovery sequence, step by step

A passport or licence image is a photograph or scan of the document, which is distinct from the document number. The number can be reissued; the picture cannot be recalled.

What it enables
Remote identity verification, account opening, and pretexting that is convincing because the document looks real.
People think
Reissuing the document invalidates the leaked copy.
Actually revokes it
A new document retires the old number. The image keeps working wherever a picture is accepted as proof.
Can you check
No.
What remains
Any verifier that accepts an uploaded image without a liveness check will still accept it. Reporting the document to the issuing authority is what gets the old number flagged.
Deeper
Government ID after a breach

A biometric template is the mathematical representation of a face, voice or fingerprint that a system stores for comparison. It is derived from your body, so it cannot be reissued.

What it enables
Presentation attacks against face or voice verification, and material for synthetic impersonation.
People think
Biometrics are safer than passwords because they cannot be guessed.
Actually revokes it
Nothing. A face and a voice cannot be reissued, which is the property that makes them convenient and the property that makes a leak final.
Can you check
No.
What remains
Everything, and the mitigation sits with the verifier rather than with you: liveness detection and multi-signal checks. Treat voice and face verification as weaker than they are marketed to be.
Deeper
Voice and face verification under attack

A medical record and insurance or policy number together cover your treatment history and your entitlement to claim. Both describe facts about you that cannot be changed or withdrawn.

What it enables
Insurance fraud, and pretexting that works because the caller knows your treatment, policy or provider.
People think
Health data is sensitive but not exploitable.
Actually revokes it
Nothing revokes the record. Some insurers will reissue a policy number, and the treatment history behind it does not change.
Can you check
Partly, through your claims history, which shows use rather than exposure.
What remains
The detail inside the record, which is exactly what makes an approach credible. This is among the least reversible categories of leak.
Deeper
Triaging by data class

An employee or badge number is the internal identifier your employer uses for you. It is often the single detail that makes an outsider's request sound like it came from a colleague.

What it enables
Helpdesk pretexting, internal-directory correlation, and an approach that reads as though it came from inside the organisation.
People think
Work details are public anyway, so the leak changes nothing.
Actually revokes it
Nothing while you hold the role. Leaving retires the number rather than the history.
Can you check
Partly. You can see what is publicly published about your role, not what sits in a leaked staff dataset.
What remains
This is the raw material for a call to your own IT helpdesk. The mitigation is process at the employer's end, such as callback verification, rather than anything you can revoke.
Deeper
Organisation-level exposure

A family and relationship graph is the mapped set of people connected to you, including partner, children, parents and shared addresses, assembled from registers, records and other people's accounts.

What it enables
The answers to knowledge-based verification, and pressure in a social-engineering approach that names people you care about.
People think
Locking down social profiles removes it.
Actually revokes it
Nothing. Relationships are recorded in public registers, archives, and other people's accounts, none of which you control.
Can you check
Partly, by searching yourself and your household on people-search platforms.
What remains
These are the knowledge-based verification answers, already public. Retiring that form of verification wherever a provider allows it is the only meaningful step.
Deeper
Why immutable data verifies you

Six things people believe that are not true

  • I changed my password, so I am fine. That covers the rotatable class and nothing else. The revocable section is the list of things it leaves running.
  • I am not in any breach checker, so I am clear. Those services index credentials from database leaks. They cannot see the contents of a compromised device, which is where cookies, seeds and keys come from. What monitoring misses.
  • I use a password manager, so I am covered. A manager fixes reuse, which is worth doing. The vault and the browser-stored credentials behind it are a primary harvest target.
  • It was years ago. Half-life differs by item. A password decays in days, an authenticator seed lasts until you re-enrol, and the immutable class does not decay at all.
  • I would know if I had been compromised. Look down the fourth column. For several of the highest-impact items, nothing reports it and there is no check to run.
  • My data is out there anyway, so none of this matters. Exposure is not binary. Most of this page is about the difference between an artefact that still works and one that does not, and that difference is under your control for roughly half of the list.

Leaked data — FAQ

Not by itself. A password change stops a new sign-in with the old password. It does not necessarily end sessions that are already open, and on many services it does not touch connected applications, app-specific passwords, or a second factor that has already been copied. If you suspect an active compromise, revoke sessions and connected apps first, then change the password, then check the session list again.

No, though it removes the most common attack. Two-factor authentication defeats an attacker who has only your password. It does not help against a stolen session cookie, which represents an already-authenticated session, and it does not help against an application you have already authorised through OAuth. A relayed sign-in page can capture a code as you type it, and a copied TOTP seed lets an attacker generate valid codes indefinitely. Hardware security keys and passkeys resist relay attacks, but no second factor protects a session that is already open.

It depends on the algorithm and on your password, and it buys time rather than safety. A hash is not usable as a login credential directly, so the attacker has to recover the password from it offline. A fast, unsalted algorithm such as MD5 or SHA-1 falls quickly. A slow, salted algorithm such as bcrypt, scrypt or argon2 makes that expensive, though a weak or common password will still be recovered. Treat the password as exposed and change it wherever it was used.

Usually not. Breach-notification services index credentials that appear in database leaks, and they cannot see the contents of an individual device. Nothing in an ordinary account interface reports that an authenticator seed has been copied. The practical rule is inference rather than evidence: if the device or the credential vault holding those artefacts was compromised, treat every artefact it held as taken and revoke on that basis.

Regenerate the set. Each recovery code is a single-use bypass of your second factor, so a leaked set is a standing route into the account regardless of your password. On most platforms, generating a new set immediately invalidates every previous code. Store the new set somewhere the old one was not, because the usual leak path is a screenshot, a downloads folder, or an email sent to yourself.

No. Replacing a SIM card or re-provisioning an eSIM profile moves the same number onto new hardware, so the number and everything bound to it stay exactly as they were. Only a new number changes the value, and even then the old one remains a recovery route at any account that still lists it. If the concern is takeover rather than exposure, a carrier port-out PIN and moving second factors off SMS do more than new hardware.

Anything that describes you rather than authenticates you. Date of birth, national identity number, biometric templates, medical history, and your family and relationship graph cannot be changed, reissued in any meaningful sense, or withdrawn. A passport can be reissued, but a leaked image of the old one keeps working against verification that accepts a picture. For this class the response is to reduce where the data can be looked up and to stop using it as a verification answer, because removal is not available.

No, because they are separate instruments. A direct debit runs against your account number under a mandate held by your bank, not against your card number, so a reissued card leaves it untouched. Cancelling the mandate and blocking the creditor is the action that stops it. Card reissue also has its own gap: recurring merchant subscriptions often continue after a reissue, because card-updater services push the new number to merchants automatically.

Sources

If you need to know what actually appeared, and whether it is still live

This page tells you what an item enables and what invalidates it. Finding out which of your credentials are already in circulation, which sessions are still open, and which accounts are at realistic takeover risk is investigative work.

Check breached credentials Work the recovery sequence

This reference describes how credentials and identifiers behave when they leak. It is general information, not legal, financial or medical advice, and platform behaviour varies between providers and changes over time. Where an action depends on your bank, insurer or employer, confirm it with them. Nothing on this page is stored or transmitted; it is a static reference.